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DETAILED ACTION 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set 
forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this 
application is eligible for continued examination under 37 CFR 1.114, and the fee set 
forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action 
has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 
November 04, 2005 has been entered. 

2. Claims 1-18 are currently being considered. 

Response to Arguments 

3. Applicant's arguments with respect to claims 1-18 have been considered but are 
moot in view of the new ground(s) of rejection. 

Claim Rejections - 35 USC § 102 

The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(b) the invention was patented or described in a printed publication in this or a foreign country or in public 
use or on sale in this country, more than one year prior to the date of application for patent in the United 
States. 
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4. Claims 1-18 are rejected under 35 U.S.C. 102(b) as being anticipated by Conklin 
et al. (U.S. Patent No. 5,991,881). 

Regarding claim 1 , Conklin discloses: 

A computer virus infection information providing method for detecting a computer 
virus in information transmitted between a terminal apparatus and a central apparatus 
and providing infection information concerning the detected computer virus, comprising 
the steps of: 

installing anti-virus software on the central apparatus (column 3 lines 40-46); 

storing a communication history of the terminal apparatus (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

specifying the time of infection of the terminal apparatus based on the stored 
communication history in response to a detection of a computer virus by the installed 
anti-virus software (column 5 lines 23-32), wherein in the continuous process, the 
intrusion detection function identifies the network traffic as reportable, will construct a 
data structure containing a time stamp indicating the time of detection; 

transmitting the infection information including the specified time of infection, 
from the central apparatus to the terminal apparatus (column 5 lines 47-61, column 7 
lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station; and 
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displaying the transmitted infection information by using the terminal apparatus 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Regarding claim 2, Conklin discloses: 

A computer virus infection information providing system for detecting a computer 
virus and providing infection information concerning the detected computer virus, 
comprising: 

a central apparatus (column 2 lines 42-57); and 

a terminal apparatus connected to the central apparatus via a communication 
network (column 2 lines 42-57); 

wherein the central apparatus includes a processor capable of performing 
operations of: 

installing anti-virus software (column 3 lines 40-46); 

storing a communication history of the terminal apparatus (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

specifying the time of infection of the terminal apparatus based on the stored 
communication history in response to detection of a computer virus by the installed anti- 
virus software (column 5 lines 23-32), wherein in the continuous process, the intrusion 
detection function identifies the network traffic as reportable, will construct a data 
structure containing a time stamp indicating the time of detection; and 
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transmitting the infection information including the specified time of infection, to 
the terminal apparatus (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station; and 

wherein the terminal apparatus includes a processor capable of performing the 
operation of: 

displaying the transmitted infection information (column 5 lines 47-61, column 7 
lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Regarding claim 1 1 , Conklin discloses: 

An infection information providing apparatus for detecting a computer virus in 
transmitted and received information and providing infection information concerning the 
detected computer virus, comprising a processor capable of performing operations of: 

installing anti-virus software (column 3 lines 40-46); 

storing communication history of the information (column 4 lines 16-29, 55-60), 
wherein the network packets traffic is logged; 

specifying the time of infection of a terminal apparatus based on the stored 
communication history in response to detection of a computer virus by the installed anti- 
virus software (column 5 lines 23-32), wherein in the continuous process, the intrusion 
detection function identifies the network traffic as reportable, will construct a data 
structure containing a time stamp indicating the time of detection; and 
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transmitting the infection information including the specified time of infection, to 
the outside (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station. 

Regarding claim 15, Conklin discloses: 

A computer memory product readable by a computer and storing a computer 
program for detecting a computer virus in transmitted and received information and 
providing infection information concerning the detected computer virus, the computer 
program comprising the steps of: 

storing a communication history of the information (column 4 lines 16-29, 55-60), 
wherein the network packets traffic is logged; and 

specifying the time of infection of a terminal apparatus based on the stored 
communication history in response to detection of a computer virus by anti-virus 
software (column 5 lines 23-32), wherein in the continuous process, the intrusion 
detection function identifies the network traffic as reportable, will construct a data 
structure containing a time stamp indicating the time of detection. 

Regarding claim 16, Conklin discloses: 

A computer virus infection information providing system for detecting a computer 
virus and providing infection information concerning the detected computer virus, 
comprising: 

a central apparatus (column 2 lines 42-57); and 
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a terminal apparatus connected to the central apparatus via a communication 
network (column 2 lines 42-57); 

wherein the central apparatus includes: 

means for installing anti-virus software (column 3 lines 40-46); 

means for storing a communication history of the terminal (column 4 lines 16-29, 
55-60), wherein the network packets traffic is logged; 

means for specifying the time of infection of the terminal apparatus based on the 
stored communication history in response to detection of a computer virus by the 
installed anti-virus software (column 5 lines 23-32), wherein in the continuous process, 
the intrusion detection function identifies the network traffic as reportable, will construct 
a data structure containing a time stamp indicating the time of detection; and 

means for transmitting the infection information including the specified time of 
infection to the terminal apparatus (column 5 lines 47-61, column 7 lines 17-23), 
wherein a time-stamped alert message is sent to the console or a management station; 
and 

wherein the terminal apparatus includes means for displaying the transmitted 
infection information (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 



Regarding claim 17, Conklin discloses: 
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An infection information providing apparatus for detecting a computer virus in 
information transmitted to and received from the outside and providing infection 
information concerning the detected computer virus, comprising: 

means for installing anti-virus software (column 3 lines 40-46); 

means for storing a communication history of the information (column 4 lines 16- 
29, 55-60), wherein the network packets traffic is logged; 

means for specifying the time of infection of a terminal apparatus based on the 
stored communication history in response to detection of a computer virus by the 
installed anti-virus software (column 5 lines 23-32), wherein in the continuous process, 
the intrusion detection function identifies the network traffic as reportable, will construct 
a data structure containing a time stamp indicating the time of detection; and 

means for transmitting the infection information including the specified time of 
infection to the outside (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 3 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 2, 
wherein the processor of the central apparatus is further capable of performing an 
operation of registering the time of find-out which is the time when the computer virus 
was found out software (column 5 lines 23-32), wherein in the continuous process, the 
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intrusion detection function identifies the network traffic as reportable, will construct a 
data structure containing a time stamp indicating the time of detection, and 

wherein the time of infection is specified based on the stored communication 
history, the registered time of find-out, and the time of installation of the anti-virus 
software which is the time when the anti-virus software was installed, when the 
computer virus is detected by the installed anti-virus software software (column 5 lines 
23-32), wherein in the continuous process, the intrusion detection function identifies the 
network traffic as reportable, will construct a data structure containing a time stamp 
indicating the time of detection. 

Claim 4 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 2, 
wherein the processor of the central apparatus is further capable of performing an 
operation of specifying the route of infection of the computer virus based on the stored 
communication history and the time of installation which is the time when the anti-virus 
software was installed (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and wherein 

the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the terminal apparatus, when the infection 
information is transmitted (column 5 lines 47-61 , column 7 lines 17-23), wherein a time- 
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stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 8 is rejected as applied above in rejecting claim 2. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 
2, wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 12 is rejected as applied above in rejecting claim 11. Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 11, wherein the 
processor is further capable of performing an operation of registering the time of find-out 
which is the time when the computer virus is found out (column 5 lines 23-32), wherein 
in the continuous process, the intrusion detection function identifies the network traffic 
as reportable, will construct a data structure containing a time stamp indicating the time 
of detection, and 

the time of infection is specified based on the stored communication history, the 
registered time of find-out, and the time of installation of the anti-virus software which is 
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the time when the anti-virus software was installed, when a computer virus is detected 
by the installed anti-virus software (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection. 

Claim 13 is rejected as applied above in rejecting claim 11. Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 11, wherein the 
processor is further capable of performing an operation of specifying the route of 
infection of the computer virus based on the stored communication history and the time 
of installation which is the time when the anti-virus software was installed (column 5 
lines 26-32), wherein the source and destination IP addresses are recorded; and 

the infection information including the specified route of infection and the 
specified time of infection is transmitted to the outside, when the infection information is 
transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station and is displayed. 

Claim 5 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of specifying the route of infection of the computer virus based on the stored 
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communication history and the time of installation which is the time when the anti-virus 
software was installed (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and wherein 

the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the terminal apparatus, when the infection 
information is transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time- 
stamped alert message is sent to the console or a management station and is 
displayed. 

Claim 6 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting the installed anti-virus software to a predetermined terminal 
apparatus, wherein the processor of the terminal apparatus is further capable of 
performing operations of: 

installing the transmitted anti-virus software (column 3 lines 40-46); 

storing an execution history of the installed anti-virus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; and 

transmitting the stored execution history to the central apparatus when a 
computer virus is detected by the anti-virus software (column 4 line 45 - column 5 line 
21), and 
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wherein the processor of the central apparatus is further capable of performing 
the operations of: 

specifying the time of infection based on the transmitted execution history and 
the registered time of find-out (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection; 

specifying the route of infection of the computer virus based on the transmitted 
execution history (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and 

transmitting the infection information including the specified time of infection and 
the specified route of infection, to the terminal apparatus (column 5 lines 47-61 , column 
7 lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Claim 7 is rejected as applied above in rejecting claim 4. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 4, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting the installed anti-virus software to a predetermined terminal 
apparatus, wherein the processor of the terminal apparatus is further capable of 
performing operations of: 

installing the transmitted anti-virus software (column 3 lines 40-46); 
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storing an execution history of the installed anti-virus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; and 

transmitting the stored execution history to the central apparatus when a 
computer virus is detected by the anti-virus software (column 4 line 45 - column 5 line 
21), and wherein 

the processor of the central apparatus is further capable of performing a 
operations of: 

specifying the time of infection based on the transmitted execution history and 
the registered time of find-out (column 5 lines 23-32), wherein in the continuous 
process, the intrusion detection function identifies the network traffic as reportable, will 
construct a data structure containing a time stamp indicating the time of detection; 

specifying the route of infection of the computer virus based on the transmitted 
execution history (column 5 lines 26-32), wherein the source and destination IP 
addresses are recorded; and 

transmitting the infection information including the specified time of infection and 
the specified route of infection, to the terminal apparatus (column 5 lines 47-61, column 
7 lines 17-23), wherein a time-stamped alert message is sent to the console or a 
management station and is displayed. 

Claim 9 is rejected as applied above in rejecting claim 3. Furthermore, Conklin 
discloses: 
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A computer virus infection information providing system according to claim 3, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 10 is rejected as applied above in rejecting claim 4. Furthermore, Conklin 
discloses: 

A computer virus infection information providing system according to claim 4, 
wherein the processor of the central apparatus is further capable of performing an 
operation of transmitting advertising information concerning the anti-virus software to 
the terminal apparatus when a computer virus is detected by the anti-virus software 
(column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert message is 
sent to the console or a management station and is displayed. 

Claim 14 is rejected as applied above in rejecting claim 12. Furthermore, Conklin 
discloses: 

An infection information providing apparatus according to claim 12, wherein the 
processor is further capable of performing an operation of specifying the route of 
infection of the computer virus based on the stored communication history and the time 
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of installation which is the time when the anti-virus software was installed (column 5 
lines 26-32), wherein the source and destination IP addresses are recorded, and 
the infection information including the specified route of infection and the 
specified time of infection is transmitted, to the outside, when the infection information is 
transmitted (column 5 lines 47-61, column 7 lines 17-23), wherein a time-stamped alert 
message is sent to the console or a management station and is displayed. 

Regarding claim 18, Conklin discloses: 

A computer virus infection information providing method for detecting a computer 
virus in information transmitted between a client and a server and providing infection 
information concerning the detected computer virus, comprising: 

installing anti-virus software on the server apparatus (column 3 lines 40-46); 

detecting the virus and specifying a time of detection (column 5 lines 23-32), 
wherein in the continuous process, the intrusion detection function identifies the network 
traffic as reportable, will construct a data structure containing a time stamp indicating 
the time of detection; 

storing a communication history of the client apparatus software (column 4 lines 
16-29, 55-60), wherein the network packets traffic is logged; 

specifying a time of infection based on the time of detection and the stored 
communication history when the virus is detected by the installed anti-virus software 
(column 5 lines 23-32), wherein in the continuous process, the intrusion detection 



Application/Control Number: 09/902,583 Page 17 

Art Unit: 2131 

function identifies the network traffic as reportable, will construct a data structure 
containing a time stamp indicating the time of detection; 

transmitting the infection information including the specified time of infection, 
from the server to the client (column 5 lines 47-61, column 7 lines 17-23), wherein a 
time-stamped alert message is sent to the console or a management station and is 
displayed; and 

displaying the transmitted infection information at the client (column 5 lines 47- 
61, column 7 lines 17-23), wherein a time-stamped alert message is sent to the console 
or a management station and is displayed. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Kaveh Abrishamkar whose telephone number is 571- 
272-3786. The examiner can normally be reached on Monday thru Friday 8-5. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Ayaz Sheikh can be reached on 571-272-3795. The fax phone number for 
the organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR only. 
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should 
you have questions on access to the Private PAIR system, contact the Electronic 
Business Center (EBC) at 866-217-9197 (toll-free). 
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